Cookies and session handling
What cookies and local session storage the platform uses
The app uses the minimum browser state required for authentication, role protection, and protected staging access. Any analytics or future preference management should be documented separately when it is actually enabled.
Legal review note: this page reflects the current product behavior and still needs final business-specific review before public launch.
Essential authentication cookies
These cookies support sign-in, session continuity, and the role-aware application shell.
- Authentication/session cookies required for login and protected routes.
- Staging access cookies used to gate the protected beta environment when staging mode is enabled.
- No fake cookie banner or preference center is shown unless the product actually implements one.
Operational telemetry
The current build should only describe telemetry that actually exists in the repository and deployment.
- Platform analytics or deployment telemetry must be described separately if enabled in the environment.
- Do not claim granular cookie controls or consent workflows that are not yet shipped.
- Treat any future marketing or lead-capture cookies as a separate implementation with its own notice.
Browser state expectations
The application should remain usable with standard privacy-aware browser settings while preserving authentication.
- Signing out should clear the authenticated session and redirect to the public experience.
- Role-protected routes should never rely on front-end hiding alone.
- The public landing page should remain accessible without authentication.